agentprime Advisories: critical

CVE-2026-63774: Subnet Solutions PowerSYSTEM Center SQL Injection

Fri, 06 Nov 2026 00:05:00 GMT

CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-63017: Subnet Solutions PowerSYSTEM Center Incorrect Authorization

Fri, 06 Nov 2026 00:01:21 GMT

CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Excessive memory allocation when decompressing crafted streams in github.com/andybalholm/brotli

Thu, 05 Nov 2026 22:55:15 GMT

github.com/andybalholm/brotli <1.2.7, fixed in 1.2.7. CVSS 9.2 (Critical). Critical: In CISA’s KEV catalogue since 27 Oct 2026: it is known to be exploited. CVSS score 9.2: 9.0 or more. CVSS score 9.2 (7.0 or more) and EPSS 0.83 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-77596: Kubeflow Pipelines API server lacks authorization for shared pipeline uploads

Thu, 05 Nov 2026 22:23:13 GMT

CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-111494: Incorrect validation of TLS certificates in the MatchPoint Android app

Thu, 05 Nov 2026 21:58:02 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-111490: Insecure direct object reference (IDOR) vulnerability in the MatchPoint API

Thu, 05 Nov 2026 21:49:40 GMT

CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-111489: A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform

Thu, 05 Nov 2026 21:47:37 GMT

CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-119757: BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure

Thu, 05 Nov 2026 21:44:41 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-85076: Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)

Thu, 05 Nov 2026 20:28:01 GMT

CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-102940: OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment

Thu, 05 Nov 2026 20:07:31 GMT

CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-116790: FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY

Thu, 05 Nov 2026 19:40:51 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-116779: FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands

Thu, 05 Nov 2026 19:30:25 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-116785: FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling

Thu, 05 Nov 2026 19:26:13 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-100358: SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection

Thu, 05 Nov 2026 18:47:59 GMT

CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-71550: SuiteCRM: LFI to RCE via AOW_WorkFlow

Thu, 05 Nov 2026 18:36:47 GMT

CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-123198: LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/

Thu, 05 Nov 2026 18:16:35 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

Thu, 05 Nov 2026 17:48:54 GMT

github.com/chainguard-dev/kaniko <1.25.20, fixed in 1.25.20. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-54143: OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution

Thu, 05 Nov 2026 16:40:23 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-54141: OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`

Thu, 05 Nov 2026 16:35:41 GMT

CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-119344: Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks

Thu, 05 Nov 2026 15:58:32 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-82907: Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound

Thu, 05 Nov 2026 14:04:07 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-83542: Apache OFBiz: Unauthenticated RCE via login-page widget injection

Thu, 05 Nov 2026 13:59:22 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-117691: Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names

Thu, 05 Nov 2026 13:27:23 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-121489: Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory

Thu, 05 Nov 2026 11:55:23 GMT

CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-96677: Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome

Thu, 05 Nov 2026 11:54:38 GMT

CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-73117: Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data

Thu, 05 Nov 2026 11:54:11 GMT

CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-73116: Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects

Thu, 05 Nov 2026 11:53:52 GMT

CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-73101: Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults

Thu, 05 Nov 2026 11:52:25 GMT

CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-73100: Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors

Thu, 05 Nov 2026 11:50:50 GMT

CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-73099: Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override

Thu, 05 Nov 2026 11:50:02 GMT

CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-73098: Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing

Thu, 05 Nov 2026 11:49:18 GMT

CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-100109: Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user

Thu, 05 Nov 2026 07:35:20 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-123025: OS command injection in OPNsense os-acme-client

Thu, 05 Nov 2026 06:29:05 GMT

CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-122992: Integer underflow in G4KLX DStarGateway

Thu, 05 Nov 2026 02:36:35 GMT

CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-122313: Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy

Thu, 05 Nov 2026 02:25:15 GMT

CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-122311: Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument

Thu, 05 Nov 2026 02:25:13 GMT

CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-122310: Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath

Thu, 05 Nov 2026 02:25:12 GMT

CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-122304: Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader

Thu, 05 Nov 2026 02:25:08 GMT

CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-122303: Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy

Thu, 05 Nov 2026 02:25:08 GMT

CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-122302: Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check

Thu, 05 Nov 2026 02:25:07 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-122051: Edimax BR-6208AC mp command injection

Wed, 04 Nov 2026 23:45:18 GMT

CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-115770: Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing

Wed, 04 Nov 2026 22:32:18 GMT

CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-54384: VitaFit Cloud API Authentication Bypass via POST /front/login/sns/

Wed, 04 Nov 2026 22:23:39 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-52848: GLPI: MFA bypass

Wed, 04 Nov 2026 22:21:48 GMT

CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-54378: VitaFit Cloud API Broken Access Control via S3 Token Endpoint

Wed, 04 Nov 2026 22:09:16 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-57566: Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy

Wed, 04 Nov 2026 21:44:27 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-102894: GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover

Wed, 04 Nov 2026 21:18:29 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-102895: GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

Wed, 04 Nov 2026 21:16:59 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-97693: Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise

Wed, 04 Nov 2026 21:14:50 GMT

CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-82418: IBM Watson Speech Services Cartridge is vulnerable to a Use After Free condition in cryptography wheels OpenSSL

Wed, 04 Nov 2026 21:03:52 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.